From ab756a86347ec0aedd26f6f36639eb045ab51433 Mon Sep 17 00:00:00 2001
From: Tyler Renelle <tylerrenelle@gmail.com>
Date: Thu, 5 Sep 2013 22:46:02 -0400
Subject: [PATCH] #1422 force ssl

---
 src/middleware.js | 11 +++++++++++
 src/server.js     |  1 +
 2 files changed, 12 insertions(+)

diff --git a/src/middleware.js b/src/middleware.js
index 78da98a056..493c92d3ff 100644
--- a/src/middleware.js
+++ b/src/middleware.js
@@ -1,6 +1,17 @@
 var nconf = require('nconf');
 var _ = require('lodash');
 
+module.exports.forceSSL = function(req, res, next){
+  var baseUrl = nconf.get("BASE_URL");
+  // Note x-forwarded-proto is used by Heroku & nginx, you'll have to do something different if you're not using those
+  if (req.headers['x-forwarded-proto'] && req.headers['x-forwarded-proto'] !== 'https'
+    && nconf.get('NODE_ENV') === 'production'
+    && baseUrl.indexOf('https') === 0) {
+    return res.redirect(baseUrl + req.url);
+  }
+  next()
+}
+
 module.exports.splash = function(req, res, next) {
   if (req.url == '/' && !req.headers['x-api-user'] && !req.headers['x-api-key'] && !(req.session && req.session.userId))
     return res.redirect('/static/front')
diff --git a/src/server.js b/src/server.js
index eabec8582b..0e5fc8e006 100644
--- a/src/server.js
+++ b/src/server.js
@@ -72,6 +72,7 @@ app.set("view engine", "jade");
 app.use(express.favicon());
 app.use(express.logger("dev"));
 app.use(middleware.cors);
+app.use(middleware.forceSSL);
 app.use(express.bodyParser());
 app.use(require('connect-assets')());
 app.use(express.methodOverride());